e27f2dac5e76ade9636f2a800b1fd45aee561f0dfdca746c8915716a99693c2b

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 3.7MB
Sample260820-xew16sfc47
SHA256 e27f2dac5e76ade9636f2a800b1fd45aee561f0dfdca746c8915716a99693c2b
MD5 d8c960d0a35582dea7abd1647af8073c
SHA1 7ff87c1844fe8eaabb5b89176b123e88b733abb6
SHA512 17bfd1110b6512f9cf044ce479e5458b8246b81103879059569f0db48742b848d11fcd717a158b7be9f8d5903e71209738ccbb8fb0361c05fef06fc0f9233e4c
SSDEEP 49152:r7JynhJ8EhdVMw7Y9odwfDFqfFFJVgrvqzbut1wOq/eVgXUeT+uXEkjNEEBHLuD/:SsoEC9Aa+uUkjDBHLuoLm
TLSH
T1CE06BE1AA3E406ACE0F7C679CED6C553D776B80D07B1A68F029098A64F772609F39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3096	elevation_service.exe
5372	elevation_service.exe
2908	maintenanceservice.exe
952	OSE.EXE
5444	PerceptionSimulationService.exe
1588	perfhost.exe
4536	ReFsDedupSvc.exe
3184	SensorDataService.exe
1412	ssh-agent.exe
5888	AgentService.exe
3232	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e3a22bc0763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000051be6646d430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090588e88d430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc3cc845d430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043167d88d430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000905f2547d430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe
3096	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4536	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5888	AgentService.exe
Token: 33	3232	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3232	SearchIndexer.exe
Token: SeDebugPrivilege	5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	5796	2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3096	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 4800	3232	SearchIndexer.exe	100
PID 3232 wrote to memory of 4288	3232	SearchIndexer.exe	101
PID 3232 wrote to memory of 3404	3232	SearchIndexer.exe	102
PID 3232 wrote to memory of 3516	3232	SearchIndexer.exe	103
PID 3232 wrote to memory of 6020	3232	SearchIndexer.exe	105
PID 3232 wrote to memory of 3308	3232	SearchIndexer.exe	106
PID 3232 wrote to memory of 4408	3232	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_d8c960d0a35582dea7abd1647af8073c_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:952

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3184

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2608 2604 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2608 2604 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cc81965d6b73dd6cbbae83fe1da9bb22638512bae7c0f309e3b961de0ec54a77
MD5 109f975d1386b2d368dc7ea89c2f704b
SHA1 99c29df708229f82528a60e90c44761589e10867
SHA512 9e15eae57789627b014122f563d8e28d875696a5d6675611bb145f683172b6678924960947c5416a9ebb4076a50df2cf210e77fb0eb50ec5fd0a311653186190
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnaQ/lFTjN4:g3q6HjBCLm
TLSH
T163D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ff64b4d3aa449c6b5a9c623109be12093a7f9617764df45c454b5eff4567f5f9
MD5 ef3313f9b3928ca7e1052099874a7bba
SHA1 849053da78f5ceccceafa860413800675201fce0
SHA512 f99286a4e5adfe9d68589786b3167b296063332340911618bc516d5b88bc0244f1c12c3589f224686df062ac3423fb3fbccc75c6e06c5225dcc0b08ec99baa2d
SSDEEP 12288:61XLsswWkxy2lRq2czABGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:QXYfDtczARnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1DE65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b62510fc4aa18885620740c1e86b424e26a2ee791b6135f928d581e93b1b8853
MD5 21c8a0652cfaf0ef6b2bd849a43bce6b
SHA1 f60417bca0b7249f51dcc6fabc3f3951ca31645c
SHA512 b08cde5003346afb2e72d2cb97c265ae14a5324f10d261104e5c620b419368076beccea19a2f48a0ec776dace2d2c3ca7c969fada3cf35d0b2ecb44134a7ae60
SSDEEP 24576:q0Le5ji0hmxLrMinQ/tbw/2Mkjy6Fr7g0oN:qPji0Al3Q/lFTjN4
TLSH
T154859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c316e0269a5283f2e8e15a0ad6b62f43f49c94e23f65316d0dd8f16ac58c8019
MD5 fae0172dc7cab18a6b5dcec3bfbe7f7b
SHA1 1e1bb4e7e3060e600bdf33dc848d7b41913e5832
SHA512 215efff068e9cebb2a01b4bc4b7a26f3edd77aa89d00ae33b453d515c481a7909c659c44d99fc62d83e5b175305850d17ab05a03aeb3da26db8ba56a9693b691
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyuMnQ/tbw/2Mkjy6Fr7g0oW:e/ezSC6vUzPvxHjyrQ/lFTjN4
TLSH
T1EB755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 680587965c8aa5f59e7f6f99534a3827f7a051c7c9ff5a8ec0808b8022476dc5
MD5 7517d72615c295d188d0548ddcd5f0b4
SHA1 00b9c0d7e503675654787e9c6f18a54c416bccbb
SHA512 c3aa8f2ae4ceb04d059d898dba379bb6bf084c00e1c53e9fb52ab879ec3eac2e80bfce359e8f6140fb4660dac763060870c33ecf0d3ea0e5b267df883dbdaa52
SSDEEP 24576:wVbqPb88hv/l+69nQ/tbw/2Mkjy6Fr7g0od:wVO88hXl+2Q/lFTjN4
TLSH
T13F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 892351d0c1851d7f21aa9f6baaa12e52ad8d4732f741ffcf340694bbe7186174
MD5 f8a3543acc6f46e147bcbc50a85c9ddf
SHA1 33e1e1370fad49e816f15d386c8161e2bb502bc2
SHA512 71888a0ed1e2603ffac2344bbc0acb7283d079fa25f3be5f15bf406dc2ae586bea99d2e53b7817d1e11d6749d7a21c7685a39bdaac425717b002f000bcdaa519
SSDEEP 12288:bzuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:bzunQ/tbw/2Mkjy6Fr7g0oo
TLSH
T10F5523696A24F897FF2B06B55CC284826B7B0EC1BFD4A74E7B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b1fe726c2def1a9c8d7a0abc28a5d7d3585091b14fccc027aca351d34b7e37bd
MD5 f1ed7da93b9503551a47fa46df3e8a42
SHA1 099233abba28b8f25b0e6719c1aa36e5b2b208e5
SHA512 9625de86f27300e32fa42533ba7cc995b7aa374deda5b4f89a8a5499d1ce7bac4fec351ccf63c5809bf32131b867c10a15c55f905bcdba78beaeb5d232d1e753
SSDEEP 12288:reBNUbTVO86UlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:rJIUFnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T17675CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1f81006d49b42cd52cd25508a917a24f42cde2a5d148b4d87b18724406baa2b0
MD5 94c58614e4f6f3cc0772df855e53671b
SHA1 3bb8dea174b7f693221e95abff7c63e644ca0d9b
SHA512 d45a0072bf062956db605d931bf64f5ffb0d2b7937469158bf06d313b6ed07c5780453a3e97c67c822e8e1137ebe9c5060f61bf30b34395457b5bca7b356f5bf
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THt:tQvGAdlCEL8c/yRNw5CfLm
TLSH
T152267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0d760a56adeb4b7bf3aff09002cd0bfd9bb1e404bcd6db591a401d45c6d3f06b
MD5 05c3d7104cee1dee4e8a5ef0d681bf11
SHA1 0b7f001e10dc40368b6d1b4851e94c9d2b1a69d8
SHA512 541042365e322a21eb84c903ede29dfeadb276be6f7de11d08d0136bb38c5656867adcd072cfd784374ed15a87bdc7651421b2b5caa22579683bc81dfdd604f5
SSDEEP 12288:OAwSfxL/2Dc39DLLmt0LDQewsAjHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg7:zQewsAjnnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1C375E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2e9d7b7353f5a8650d733ef555d502677642197ed67516f9212f2cd7b5b6ca3a
MD5 28662722cb9d9dc41c2e064ff0b633c8
SHA1 3ed8f101d21c6736a4ff740a215369976e32bcdb
SHA512 13e57aafaa1f6e520c2ae4fa821623ce59673c20c3b38210420256e770d8bc76e6f1e72d517adf4a7ee77b542b10826af57bec8115619307418817ab001e2228
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0L:dUEtQevvqc2W1cpV2EI32
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a7c77c2458974a31fc9a90a1d6cb0acc15986dc61626dfeea080c5706efa6c06
MD5 2a395c7379a2114c28b0022f87a620d7
SHA1 59f4b98149bd6c98564995b6119319449d3d8810
SHA512 e41e3bc01eb8a98af440de69713aeaa0f0a9b267ff20ba78aff2c4845c62b93c1d960601b021dd7d309888e0d6eab9d10f576f0e71774ea13fd0ce7f1eca55bd
SSDEEP 49152:1CbRquA/m2yL5zQfFiV+XenmE3/zHQ/lFTjN4:ioqtVjnmTLm
TLSH
T18CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 51d3600bd193da078768a7349bb1bcb10e096c290e4d9079fb5e345bcdfa1390
MD5 ebe17747de89f30db5fe6395677015e2
SHA1 923091d92af9f36f39fb8d710e87f7fb57342f13
SHA512 3baac26a71b4a62f284a633197ab86afa9f1ba2954120646d17ad17c25f5b9593864786589f776f4f0a8b8b3e07443bd82660ee31c2e4079efcaa46e261887af
SSDEEP 24576:/AhGLJIFoiwtA5l7S53gnQ/tbw/2Mkjy6Fr7g0oF:/AMyFoiq5wQ/lFTjN4
TLSH
T15C35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 06f0ba0a6789c81ba37054f810a2ad81622aaac2d3c0c3be517e7d64270fb57f
MD5 c3aa3c3403ec34e0686270d1eee66738
SHA1 08051966bfed092935e645375475c71c24e291d3
SHA512 de0290f3d5ce9e730cceb2af3f57fce0bd639e460e35cfa8fdef8f8160ec82221ec3ae6d9f87fb1cdc5bd6ab5bb7ee5c6d2894d2608f3a48b5910207f263df1d
SSDEEP 12288:Jmw5HEjsChN2BFgl0WDm+CsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM+:EwuHOWLnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T10D65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b90ab32802ca2cc0aa37b2f444e56592022cebec912e6bb3f0c1e957464790e9
MD5 708bf1063cc53862f6435718bf94a9b4
SHA1 0b8047a931613132ee1d31331b429fc0993f08dd
SHA512 54bcc75c71f4f9143f1fd69218c5d7d8f574443f3f948492789eaf836ec36f8630184be3e63b6cfca119399e5fa0805263a6350a50e7befb0c81d2faa617a250
SSDEEP 12288:0XZ1Iy3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:0ZuKnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1AF55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fe9082092a8af93c190f1dfcf493372e93e6afc1b76ee70370d9d4dda79ef738
MD5 cbfd83db4ad80e376db30bac5f09fa9c
SHA1 7134c5852b25ad4cd2742f814ea1c4ca8de67aac
SHA512 e4a6953c9d9363a95035226f79da55d3dce2b13e86568b50346f18cfae6ae4f626246cbc4dcd98358030fd646cb9cb92cfe4d459c0eaad01990e20c38e3e4dee
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:FQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T1CC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2a9f5918f6e71e46b8bfe4aab376ab94237b51256aa2c2d707e0f34d15fbf77d
MD5 ff832050b74159d36bb7466263ebcf7f
SHA1 bdf6d571f08f9098ea76fb1408397be2a38ed947
SHA512 535f18a4e2266761a217574e77b57a96ac9b446dd661f22d0ab7823b9776f9a13a45a84b74ca14e0eb40a40ec432b6751c01744966f04a0ffc9083276341c766
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:hQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T1B7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ff0d044e16a8118d7c9e435139141f710d89ef1a7bf87796a686dfc5b7b45cc9
MD5 8ebeb6f3a8aaa97b15d23adea2399000
SHA1 e57012537eb330e96f24aa63ea8e8f66194f6876
SHA512 b0a9b36c736b7c8c9ba2463cef808b948d37d721324e89499d46f8bd67dc03537eb459f58b2b11795a8a305f6c7d7020f248f4b4248a9dc8d96322108c092ec6
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0anQ/tbw/2Mkjy6L:w68Qg55nhheWu7PNU3/3Q/lFTjN4
TLSH
T108B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4a1c44dd39fc2a8e235207663e756e8879fe4d393bb43ea70406fe38af5141c4
MD5 ff6141e40c64e4e845cf7bdd41e9ffba
SHA1 3a3b6005bfc1e20bb1b906936a2f1ac244ca3c73
SHA512 201d49c39e4b1e235ab107a321c1fff6d15e5cc241b9215556387e4441034c8e6dd5ec3e4d1a29a9de1749de16076be84adf95e289bc10d87a81ad6d2b0196b7
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99v:py5112gYy5azzVvL69nLKnhZJLm
TLSH
T160167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 68b52dac8af4f62096b2a62fd1bdae8dde95c3ebab612bfa20a9300bf0f8c29c
MD5 091234417efd2b7a6536eca1dc3bb0bf
SHA1 109742f16a4c52bbdcf5f065164cb71fecc39a9b
SHA512 2e2a78fb2989190bab104bd2301a8a3972daca7267a5c0878aa440f0e81f0490a9e2d1f8711202b017513bdefa12a2d3292a0791d057d9a3711f47d0c5a6a139
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glhQ/lFTjN4:Pu6JmVxd2dGLm
TLSH
T1BCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 15283154f1a1bcfc6ac3a854e3647841f2cab4f055c090a8b3e17c443cacf22a
MD5 2b0549330a83f8ba10124c53b2f7fbc2
SHA1 14b1d6546ad2aebbb1bf1be7969a36e1fba4ddf5
SHA512 af1de835bc63146ab712fbd73c52f0ff35f97efe03bc313038644ddb48e1a4f786de1046da2c8cb6266b71ecbabf81bc55de295ebebcae77afc2328028f7b716
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xlQ/lFTjN4:CmifPbRTLm
TLSH
T138B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 992b55881d273d5c73aa78fc953672ebecfb91b963a67965cc3a40cbd5756937
MD5 d8b5c212e4cde77dd0058f08a67c33ba
SHA1 f6f9ad2ffd0ff92584bd0a21228ce0c592a3963b
SHA512 c99b29c8856e9d2bbd30d7c4ab82cec16335ee0614b422d0e2484d528ff0f2c021e8c13aa52c434bc5bf7d59df0c2c174cd2d0f9f33f8f5c90b7edf6ebb583b2
SSDEEP 49152:gSuZQIY0Be2KRRVtOnks6NMHqKQ/lFTjN4:65dKTi61FLm
TLSH
T1B8C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 317e85f7ad58a8fef42850ad033e13576c29a145aef691742216569b91dd2e85
MD5 05033f8989a1991bae28f3caca5c6789
SHA1 b9a36f9c3e876118500855989a8071bf47dbb81e
SHA512 e98ce5a7bbf4209ad6d396467cabf94cc142630a3a085375104f985bc94a406b8ce9af5966ca9ee10afd1abeca8f85aa85fcf84c445bcf8f42a5715d3a4ec740
SSDEEP 49152:JhtSn8EApI0figngiDn0AP5wRQ/lFTjN4:4X2iyphnLm
TLSH
T14395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 64c254b74ae6c0bf30ac8d2df8825f9591debca884f51d3dd25ba39d9745aaa2
MD5 908b60a41fbbf12e53cef6e15dc9a011
SHA1 b10065dcde11a0d4b2f8a80f9ba8e77e01b33991
SHA512 4bc3448254d4dfc1ace7c6a6331e821c603710b37c4e513a0e76adb87c36184788907cacdbeacdc104546ee511aee4533cce76fff171a574d32498f1f36d2616
SSDEEP 12288:qWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:q2nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1BA5523693955F98BFB1706F14C828182A77F0EC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2860e5ce7f37f2f516e07278d0a5aa73b2768d5236ccf448279962a223d74b0b
MD5 7aa0ea1fbb6954577a1f56d9aa519bd9
SHA1 536668b3f1c55b0b9740b596874b4e5611231e4c
SHA512 f0fa4d8c85e25d33946da0f918bd144ba4bfa32225bb864938a44b41641fe444c4d797e5ba818842cd7883a01c51ab401edf55a6d9d4a2c59f56b79d29eb25ec
SSDEEP 12288:7zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:7jnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T11F5523697965F98BFB1706F148828182973F0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 551455e0db5026694149da3748a24f8ccb013bb238dd9c79951cc0b77065decd
MD5 b14b6c2e7fe3ffc017b8a6888ebc91b4
SHA1 0be986d4abdad7ffaf8d828ad16cf9c6e05dabdf
SHA512 44431078b02e0c32dd1a4aacbef87c7b8f8e100d0a4c2bb5348ba711f7d1dd25c6c4c256577ce543ef18c3c252ab6a03014bdb910c3d6659d699aeb4ed1a7702
SSDEEP 12288:TtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:TNnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1335523697925F98BFA1706F148828182977B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 430865c7fa7bff702106874de1bffee83109fde220ee33039cad042d7385ed33
MD5 bd14bc72c73e274c115d5686a305e068
SHA1 b65c5efb26a3b05540ab963613f2495c9ec76398
SHA512 105e3d655da80945c7db04710b6a27b29f42b1bde75083db9a4121e0eac7ff0f2c1358838c73a366230351b8babbaa10d05346cdfcfc35d13054783f6efe1763
SSDEEP 12288:eVgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:3nQ/tbw/2Mkjy6Fr7g0on
TLSH
T1C65523693A69F4C7F92742B4CC938142E7BB3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bbcfc831730f359b1d4ea5e1d21cd6e203b9488c687c8047108106de949f3147
MD5 fa9bc8232ae2bbd2f5669a47b0ff4b9a
SHA1 54144652d401da0489a4da7e4d683630d239dff4
SHA512 067aaa8a309d43b1455737d9f3c70661480f1d8f40708f5d8b4cfdd16b9b34a6315b93bf34ac6cc19910270ab295ddfa34628e18c2e735af6f97fe8f9e66e0fa
SSDEEP 12288:74GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:74nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T17C5523697965F98BFA1706F14C838182977F0EC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2c3f43b1ee55a81533a0d9cd258babcace419be163c0bcba4aa2205a76deba39
MD5 64380e5a950f9c392bf38bd036413924
SHA1 06963a991acabd4a70ae331554b363adad6c3de3
SHA512 225a98c442d3b59b816d20cb2b73136eb43efc7277a2351e2030ad5a99e8afe26408e41a922736887b243b03be8392a8ba694fb1598534db057ae07805f1b637
SSDEEP 12288:3PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2C:3vnQ/tbw/2Mkjy6Fr7g0o2C
TLSH
T1C35523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e4debb6caf382f70400e0817657d3b9f6566432974c7f9800c7682143ddd4fa1
MD5 ec70124138140731c5abcc6f61986b17
SHA1 270ba1ee7f0147a6efd56d49920ad471a0656e76
SHA512 f095fdfe8504822191aacc097c6a6dc36485f311c75f533778466b76c9f33b6fc87411987a89631f7a392557496566a98fe66b44d93a6df4e4431662d355b21b
SSDEEP 12288:mrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW26:mbnQ/tbw/2Mkjy6Fr7g0o26
TLSH
T1725523697965F98BFB2702F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5ff13b69eee35d48f3ab91ee083e54f03e63cefd1dc043c14541eb7afea6e7d0
MD5 46f3ef863de6dca458f57c4b13e21668
SHA1 566e472182ee6014298a298573ca0cebef6da88d
SHA512 c7574cfca8452577b93cd413de3092ad429046e30a296feacaaa6dc11ddaa5c93629170235e7c0a3dc30b10f6a8f38e26f8b3046f726dfe086aaadb28a9e8d03
SSDEEP 12288:iiZwbDzzFEoS2cPvyTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:FZM3zFVSODnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1037501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3c1e43e4a7838a67f48ae21f58aec30add74dc9c122511a6b7be9df5266412e3
MD5 479548a5a8a060c63302e37d596b2fce
SHA1 80360ab182d9a9e2d9869691122be5066b7e8696
SHA512 1dcfea3bbaae2260a6a8ae4ae9db1d534c463fa957fb198f3feb31541f670f9fe1cf03339903d30dae387d7c74a9db36fc0b1cfe1be0a68c5716e36150f21317
SSDEEP 12288:d6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:d6nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1F25523697965F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b6016fbcb325a9f1d6ac59f8f06909a2d1ecd18781949f1e52097364bbcb1b0e
MD5 e98a24f87ec299e722041d3405a6d020
SHA1 d1e40853e60aca5a903118756a5d0afc17c55efd
SHA512 22be8ad2d073152498f9b44ec6a78613054446e2da3d70dcd102e1b34684fe5138eab39ff3bbe1e5f6e1362be834fdc1615ab499ac2b66d64b761575038539d9
SSDEEP 12288:GeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:GenQ/tbw/2Mkjy6Fr7g0oL
TLSH
T15F5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0df6b870ddf4ffbb0a6d55d00f194c21c8f8d67e2b319ac2711691934e70c03c
MD5 a897c9039aa6e110046b0260d387622b
SHA1 d3b29aa892c59f197ab9d9062ae24e9ba381dce3
SHA512 24d0669a9c81ae8675b427465527c06be190bb831739f1e04de3f63d73610db5876cec51365d4a0fae4533522767d8928c37a86fd3e7b506804c8f761d9182ef
SSDEEP 12288:zyPz5L83GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:+zyXnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T13665021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8f38642125621d37c1fed817051e48d1f1142e5ee44ad324607c545adb9195d5
MD5 d9bb9e95969636e77e93db8348a40b98
SHA1 53ebe13e969eb1c396afbb5bccfa8ff4255002b4
SHA512 e9f32f09bf896a888ee4678d75a31825f5d30d880edbda8c6bc82e701962ffbb97a648511bb58c69f26675ee735125ec2adbc224164cb1b36d3ce7238fc1d2b0
SSDEEP 12288:M6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:M6nQ/tbw/2Mkjy6Fr7g0o2
TLSH
T11C5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2183c97de7a9b9bbcc071fed76ee643065afebe122b1564e0989b33275ec94be
MD5 0b90c815417c2ced9a20ac43150388d2
SHA1 a478f361b4419af1cd867a97de66d851baae63f5
SHA512 713494ccb9f40f1f95dc0343129a54b3994abdc2ffe397ed72d2a97ae96cc837f0f2e1a9018eda34736c9e0a1578a38d424c40bec8503a639d3ee60c0dd58ceb
SSDEEP 12288:w6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:w6nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1D95523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 6a0c80ef1d7eb99182b8a2c3954ba1017626ffe0aaa5c35f856ac8fe84e25e46
MD5 9a2d71a5a377a52ce8ae379d90a5e2ff
SHA1 1905638d7ad4c3f530f6599bb12a5861f2feacbc
SHA512 a0020bacf509f7d762c848026af21ca1aaba62a3aa3a056f2d1c0aa752de1bac9e973d511ef25bf0eab6d80e4c95de9d9c2a3a880725485a96a602d60bc22d8d
SSDEEP 12288:iyPz5L83GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:/zyXnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T17365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 227b1d7258a46c7289565bd93e2ebbadee83935c01e7badfd7ca7f4ff7c55dce
MD5 4518aba61c66307bfcde585cbddc4ede
SHA1 0c7308c28caddd520039cdffa56672353628b72b
SHA512 ceaa2097db21f485cc412977d02f7592dac17e10eca58c00d7b01cbe41db822b86899335aecae1a097f64d7962a950509aa994c225a0933d3b7609339d29faf4
SSDEEP 24576:0T0aLl3z0zDdnQ/tbw/2Mkjy6Fr7g0oW:0TDLljMQ/lFTjN4
TLSH
T1E87501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a4696ecdbc86536401a6d9abc5d935e8032222ce17719b5a80a983ea628ef2a7
MD5 bccbf9ceb48e21d52f1ceaa7fe14dfec
SHA1 4e147c7640bc66b1484b8b2af1f615dddca4f4cd
SHA512 6888a57165f9b48a334640753d6f56d5bec9912370662eedbc78aa80544107b38bb69c31c70ec1a5aebfb788da1501890d5d14cf61d887c8f95c15272c0ae78d
SSDEEP 24576:R31d9CHKy7GZ5nQ/tbw/2Mkjy6Fr7g0oF:B1d9CHKyafQ/lFTjN4
TLSH
T17685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 fce66a8099bda26f6d43e91984199d69b931bd42b27db8908f0cd2222d607cec
MD5 b1e7f690321d768b826334cf6e53b577
SHA1 60236e08ed67025c9b4a91fb5d44632379a5d01f
SHA512 2771f142c9282dd95faad4532c3fb73781f714f7f887ce42dac158e7497d3eb132ea96d0740ad0d6943b34130b3bcedff874d20aa5a80e47ecfb85cb42cd61fa
SSDEEP 12288:pNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:ptnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1465523697925F98BFB1706F14C828182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 895a486b220cdf21b3733c1996a801fcc27d81acc58e9fe29da9533bf5dc6ca0
MD5 7f8c59d7c9fb4aac35b1ab29c9f416e5
SHA1 4cfd9328a212de767e270feb8ae59bd7e5c17d85
SHA512 a193c86d039e125e2cc4722fcfd01490248d97dac19486aa0ffd0ebbda9ba955b2201324d2745e558dcd233b7afca725792e68ecb3727cc29b62f37bdb5e8c25
SSDEEP 12288:mXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:m3nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T19A5523783964F99BFA2B06F14C828182A77F0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ff7cd3284590dda1cd8b1635867aebdafa7642b83434793fa0dee2cf104f28b3
MD5 3d5f5f86af733b31805fdb45b54485bc
SHA1 b58b34fe88c79355d2d10019b80e07fe4064ae1d
SHA512 80787fd35691b33f055ac563a9bd14a2202a32086be88561df8e09654012133022527c9a0aba1b3a3a9a362678a6255f1c6f4383ec62ce7777fbcfc635d57fdc
SSDEEP 12288:BEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:BknQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1BB5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 de85b1c686904de23ba92bdcd003261c645acc1651995497b3cdeaec5eadffae
MD5 f7b097809a2114b2de50f2f26da7168a
SHA1 179de207fec91c1928bbd084947def6a0ae74032
SHA512 5576d7a531fe7ddbbe5c036883d4377a7a539c8b27a2722777520004c92250199aae664283956dc90e2485b1c2e4bbca312ae3ca33fb472729552937a26e2da5
SSDEEP 12288:s6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:s6nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1B05523697925F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0f5c82d9b7ce596fbce3b3c91a1e51d31672625da00eb89745ace181b775beb7
MD5 87a58016f7106199e56ff2c325fae685
SHA1 f43441fa7812117b312af83c5fea9a0178cb76aa
SHA512 96ee8ff988d63c7a28a3b74d76caeb8bfb7e86ca3d949d8912384a12b19d63ab96871dbcdf8e57b551deb1ca471e946dfd11c1efd487ada4f9a9dcc11923b9a7
SSDEEP 12288:ONGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:OtnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1085523697925F98BFA1706F14C828182977F0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 21776867ab7446d9bbb535f8caaccc2643bbbfac58072b522c6c80e39a93ac9a
MD5 3455afda64bcfd274f4d78eb6d5909d4
SHA1 9f6eef0cc9729836b712496603e1b9ef7e88bdef
SHA512 6e3cb254afa5619ffbea6ea7bc01d71e6f15d8fc2352225495314fbfa84ac9c88e28c40b5ff5ae9d80fa85cdd625e37ff74b1ece1a7b3afe8808627e73c344f0
SSDEEP 12288:+yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:+ynQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1B95523697965F98BFB1706F14C8281429B7F0EC6BFD1A38F7B481229967C39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 2741313fee44c5716feb48bfd005973d2ef4bc855cc7d27f71735eceb3d1d48f
MD5 737ec78d4b1aac9980f027a78ab11575
SHA1 3fdf518cfee28c07d3da8d5d5859af43550427d1
SHA512 a387b7b9a4414d463c94bf50f104ebdfc140f361980ac456553ec224e5c11d05f2f888916e97904429970227194a08c2ba6e94d293a56a0f4534b362f9aa318d
SSDEEP 12288:N4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:N4nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1915523697925F98BFA1706F14C8381829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 f632ca125590419c1016847db7ec0114cb10870db3701dca542ab5b5326929b6
MD5 736932bee8305d00870801a7cc9f23c5
SHA1 6c870292ee92a6d3e4883c41bdc825d8be795330
SHA512 224880f1ee47991f95824f3400a05eaadfd7b93a2364fcae4be82117caa04e1a9d43f60d35f784667fd770cccdf2ae412a12d91520ae666e22f3d1c3811b923f
SSDEEP 24576:sfwv/k9RX6wkyAIOnQ/tbw/2Mkjy6Fr7g0oO:bMnYIOQ/lFTjN4
TLSH
T11D85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ef9c33216598061792af813053c17556124b7a51ee7a70cb14a6333c25db769a
MD5 5ac08ff7a30a322087654e65c6d93156
SHA1 879599c713fdaa9d8b4a1cf03567a5e9a238f05c
SHA512 a5ee68208e24f16e10f0f6a3f0e5c2e78f2c5a3bdee641064496531537edd31b3bca731749f721484c90547ea095a36240358324a64c2364adbac24dc9b5b145
SSDEEP 49152:5YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xQ/lFTjN4:hySzPuLm
TLSH
T1A5066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8125a8aaa9a3b78129561b7446d0c13541b68f60ccdf50cb3ffc7a162cbc0adc
MD5 1b7ed566a50f95e10c6cf7795d1549b6
SHA1 0606f1f2e35cb55ca37d4f231238cc087d28c199
SHA512 a0b2629ae206d9606e7dc994c4057a9f01c3582e643cdf6f3bf129cecbf404058bcfe34416c8918aa46667c5de4e9b96c69b882acf0d77a98a11b2c4fa9f9d34
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYznQ/tbw/2Mkjy6Fr7g0oo:o47JUQj1irIhCnDHUPfF/hQ/lFTjN4
TLSH
T10465AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1c7a31a69920d83151741f1b3d23b18543f1da52663455193c2f507c3cd8495f
MD5 89d8996f60754a774ada6b8b8b7c54b6
SHA1 719567b64d8f10d8624dae4c80c565ea6d34396b
SHA512 969a15f0747b8b709dca756b7b2be1975ed75fda4270a3a46c477c565ef6c8be16aff1dc4f6f64915fa0587f894d5ca8d529455c79bdc91ffc04cbd33f6f8118
SSDEEP 12288:BssfKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:pKnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T18765F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 32cc52ec0ac90ab3918af8560a440cd180a923b4c390c8b286cda96f572b1035
MD5 a9eeb2c8f2c24db03efa5ec736552717
SHA1 116812b269fdf04a8bba90b59b61d61e6b07ac8c
SHA512 52b9ad981a6bc81993ba6ee43397ef44d191cb6e5f6747f81aeecee6f422ce3893f60d640afdd5a5f44ad86b03321bcf6d817b35ff37a6fddfa8e1ca76281520
SSDEEP 12288:3MjRfU3f/D5/ZLIEwtVDDDgaoySLWqE4MYIrABRMDTIgBeQeAs:3eZUP/d/ZYSySpE4jIsBRMDT7BGAs
TLSH
T140453950766AC75FC6A940325E32C1CCA7707D05EE45AF0373C89B3FC576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 893fff6f2b7fa403738962257203c60c43f88a8d8197bd08ee63019a3fc39f36
MD5 9540a27d9e706848674156292b93979d
SHA1 3ef236a832dac1eb9d98db74c6acc36c6b5024f7
SHA512 44e7ac27588fbc0ec58b910fde4fe7e7fa8cb9c9bdd1f94d058acf67a7b54fcd543e2c95c3443abdb216b262ed54e31435df9282679a879ec6dc96a25f5b508a
SSDEEP 6144:dBZRtkzEKdzqmI6a6m8RjobMJ72JryR3q8D0MQJ0hsULTCi2j47kJMytMx0MytMD:ZOq/wL6rXib21
TLSH
T109650A81A137E38FD1F7603207299B4CA7A4EC06B7455F26B3C9453AD82A725A4FD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 df26df8b3657cf605d817de7cde620b0c90f183653c16ee6aac64eec49b5f8eb
MD5 53720bb9428716a267da1fda7c2effc8
SHA1 033562a02e2c6c213e83ce11ea26a781738c0f34
SHA512 eb1f1811c9070d05cfc6c982225b24e42f31cbf10d6c8b3038f5e370b20268fe05c37eb3e9c7aa5c8567c6608a61a71207f92e905c2b1713ae32fa1d48be3b61
SSDEEP 12288:P67CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:GCnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1FB5523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e76c60b9ba1bddbd2d4828c9ceec80187a93a22b0af5df03ff3ca97393e313d2
MD5 e5e5323abf7bbfabf8bff4272519767a
SHA1 bdef05086ef6e3b085ff764abe0d52a82e1b4734
SHA512 ba3429769e3c52add831fbf0b5ac7f62c58dbcbd85852d719c404c9d6d39d46b8b11340f081159abc175c30dc57c88544d8002abf65174a44d8c378aba64bef6
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYMnQ/tbw/2Mkjy6Fr7g0o/:jgb4mBIBhGFzQ/lFTjN4
TLSH
T11665AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 0c2581a9bf545313a25afed2b302454c071d56de37cbdb77e9f2a00b123b5659
MD5 4f22ca877e46fe1cc15827afa1ceca24
SHA1 88966c50d8da07ff9c8762eacbbeb3dde2076d7b
SHA512 1e3decb5fc35f0e46754b74b7646c5a89a38f486ac43c6b92771c2ea05f87030d0836c5096a735fa0e27c478271fa2e39af9c9bd56fbd9efae45d68eb2a2470c
SSDEEP 24576:8G88u8FpJqH1Qzria7/mDnQ/tbw/2Mkjy6Fr7g0oy:/7ZFPqVva7/EQ/lFTjN4
TLSH
T1F785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dd75fa094d52488511f85ad85090951e41d9e92d128ed56e608247d48e2da0ec
MD5 e92f40a10a488bc274d976ea58130d04
SHA1 2fec87de6e54da4a7bc2317ebb56cb38d33ef434
SHA512 c14e7ad5e5679873cf41034f78e01c6558ef7c7a2cc372e453d7ab7865e02f5e9f1819dda950827d1f7d91e9cc7304c11ed0618dba429c25973441388375f969
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvQ/lFTjN4:2G05lO43bxLm
TLSH
T1F3D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 521ba9c414770438f88fef584062f33bcd9aba4b82e9ab35f4dfa3303872793e
MD5 1a39885e26af303809c4a98f96d6fefd
SHA1 2cf473343c46d8ef55eb6f6cb11298d1583dd40b
SHA512 6cfa39e366e90aecb931bc2a9b6e26af8e87ef26f208168c9cd45ce8f1be7da90e500f2d4be5b7ea9080165e3546fa81b3a8e41cf1ba3a2ff52b3b85252d4f50
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnxnQ/tbw/2Mkjy6Fr7g0oC:Fa5POZ3+Jt2pasx2+m3Q/lFTjN4
TLSH
T1A165AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a42325bcfcfadb0d8b99bb22b43f282d91ef5133f68d1801863a226f445f0d8b
MD5 b846479ee3b6850ef3b0b1d4066a22ec
SHA1 a7f3f12e2aaa705101d74f53aa5eb31931326d4e
SHA512 2bbf9cbe4bf8ecd9f0296bc7bace1f28b332336b52b190b65a7cb028525a7655b2d589de2da3a80d814b8c4a8454bc9a11ce5ab976e7a5a137d96cf7b1bf4e36
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkrnQ/tbw/2Mkjy6Fr7g0oB:uNc/zEOVHFkQ/lFTjN4
TLSH
T195858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e7d12e0216af64ba104e721504175298784f93a1de240a6d4e760f0e783c83e4
MD5 12d53121efff4d1aa4feb2cd628e4a37
SHA1 597ef60f9c0b2e3d2ee085938d98ea7672a70f09
SHA512 d1dfae6bc9bbd3cc89a782c8c296f248e78904a70f6ceab6dc965821249e72554c1de309dfc3d0e06f6f1e849ee013746049fb97e36f712dae2d01626a546ecc
SSDEEP 24576:j8kNvNnaFeYhJNtmZBm1nQ/tbw/2Mkjy6Fr7g0oN:j8MwBtOm1Q/lFTjN4
TLSH
T19355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 0273b641c400e20d87cc205662ecd6225b31ea7d2fa788c4f53b396ae6c574ce
MD5 daedaf9e4cd9fcebfc2050f357155009
SHA1 7a459062607af0c332fe9f9863c59550f5c1cd64
SHA512 a2c4bf571862cb314537a5a1fbcf2adc82c91d2976ad7b20cb6184f036f02075ddae5fea211b24dd512724aa4f7b27f539378401db5e48d48aacfa68f7449afc
SSDEEP 12288:wHvUrBFrEjwaQ/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:wPUr+NQfnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T19865E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2014a2c40fa490858a24d20ae3c223f05e27e4188936cc753e5f122352c8c906
MD5 4400fa4c57bb83b2741cbd178bbad3d4
SHA1 5360e23337e8f195d2fc814d0469775860d8f45d
SHA512 b93190a7df95194947413ff1f33cbeee7ceda7aee313eb8261c94c3205f812b0d9b797eea63b3c055821266670d60fed2c930daa52d2dc67989c9c9f1e94e172
SSDEEP 24576:+D3FHshBIYQgAWnQ/tbw/2Mkjy6Fr7g0oi:+DVHeBIAAWQ/lFTjN4
TLSH
T14B75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-56-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/952-246-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/952-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/952-62-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/1412-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1412-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1412-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1412-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1588-81-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1588-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1588-85-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/1588-79-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2908-47-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/2908-41-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/2908-40-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2908-53-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2908-51-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/3096-16-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3096-24-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3096-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3096-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3184-109-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3184-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3184-314-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3184-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3184-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3184-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3232-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3232-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3232-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3232-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3516-329-0x00000266D9430000-0x00000266D95FA000-memory.dmp

Download

memory/4536-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4536-330-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4536-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4536-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4536-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4536-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4800-417-0x000002412F440000-0x000002412F524000-memory.dmp

Download

memory/4800-328-0x000002412F440000-0x000002412F524000-memory.dmp

Download

memory/5372-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5372-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5372-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5372-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5372-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5444-66-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5444-68-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/5444-287-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5444-74-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/5796-9-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5796-78-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/5796-6-0x0000000140000000-0x0000000140410000-memory.dmp

Download

memory/5796-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

Download

memory/5888-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5888-134-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5888-128-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5888-139-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/5888-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download